Windows Action Centre shows a detection for Win32/Small.CA

  • Article ID: 119716
  • Rating:
  • 35 customers rated this article 3.7 out of 6
  • Updated: 10 Oct 2013


Windows Defender shows a detection alert for Win32/Small.CA, however Sophos Anti-Virus shows no such detection.

First seen in
Sophos Anti-Virus for Windows 2000+


Believed to be a false-positive in Microsoft's Windows Defender triggered by a crash of services.exe.

What To Do

Obtain file name from Windows Defender report:

  1. Open the Windows Action Center: Click Start | Control Panel | Action Center
  2. Under the section labelled "Potentially harmful software detected" click on 'view details'
  3. You should get a 'Windows Defender Alert' dialogue.
  4. Click 'show details'
  5. Select the detected item Win32/Small.CA
  6. The relevant filenames should be shown in the 'Resources' section.

Check the event log

  1. Look at events in and around the time of the detection
  2. There may be a crash reported for services.exe

To check that the machine is clean:

  • Ensure that Sophos Anti-Virus is up to date 
  • Run a full system scan

If you need more information or guidance, then please contact technical support.

Rate this article

Very poor Excellent